Move the k8s-workload-registrar back into same pod as spire-server

The k8s-workload-registrar needs access to the spire-server socket and
therefore has to run in the same pod to be able to mount the socket
into the container.

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/values.yaml

@@ -105,3 +105,35 @@ upstreamAuthority:
         certificate: ""
         key: ""
         bundle: ""
+
+k8sWorkloadRegistrar:
+  enabled: true
+
+  image:
+    registry: gcr.io
+    repository: spiffe-io/k8s-workload-registrar
+    pullPolicy: IfNotPresent
+    # Overrides the image tag whose default is the chart appVersion.
+    version: ""
+
+  resources: {}
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    # limits:
+    #   cpu: 100m
+    #   memory: 128Mi
+    # requests:
+    #   cpu: 100m
+    #   memory: 128Mi
+
+  securityContext: {}
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # readOnlyRootFilesystem: true
+    # runAsNonRoot: true
+    # runAsUser: 1000
+
+  logLevel: info